This security update addresses three vulnerabilities in Ruby for RHEL 9.6 EUS: CVE-2026-41316 (CVSS 8.1 High) allows arbitrary code execution via ERB deserialization bypass, CVE-2026-42258 (CVSS 5.3 Medium) enables IMAP command injection via symbol arguments, and CVE-2026-42246 (CVSS 7.4 High) permits information disclosure via a man-in-the-middle attack bypassing TLS. The affected versions are `net-imap` gem versions `< 0.3.10`, `>= 0.4.0 < 0.4.24`, `>= 0.5.0 < 0.5.14`, and `>= 0.6.0 < 0.6.4`. The fixed versions are `net-imap` 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Red Hat Product Errata RHSA-2026:33462 - Security Advisory Issued: 2026-06-30 Updated: 2026-06-30 RHSA-2026:33462 - Security Advisory Overview Updated Packages Synopsis Important: ruby security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for ruby is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2461369 - CVE-2026-41316 erb: ERB: Arbitrary code execution via deserialization bypass BZ - 2468498 - CVE-2026-42258 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments BZ - 2468499 - CVE-2026-42246 net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS CVEs CVE-2026-41316 CVE-2026-42246 CVE-2026-42258 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM ruby-3.0.7-165.el9_6.1.src.rpm SHA-256: 78f429549e1ffce18520aa24a2a8724b28cb70d62092e4dd375286a485906c4f x86_64 ruby-3.0.7-165.el9_6.1.i686.rpm SHA-256: 0bbd5474bad030017d0ce7debfe01a90b2d2c9b5f3d876642cf2000fae3eb81f ruby-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: d072f7e6ac83e66b3bc5c69f1ab308a8bd345b0ee97d36b5867faf37d81faee4 ruby-debuginfo-3.0.7-165.el9_6.1.i686.rpm SHA-256: cfe339fd89e68418520105425237f85084d918b95521536acea1d373e4a89e69 ruby-debuginfo-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 9aa85829d2e443d0af70cd1276ffa0e357885ccf2d56e816a19b00290e7826f9 ruby-debugsource-3.0.7-165.el9_6.1.i686.rpm SHA-256: 42ab1d36129d25be08e13ea0e6eb03b3bc745aa61ef8c7616a932f2066ebc9bb ruby-debugsource-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 7fbcacd61ceca66f5057326f4f6e464b734b25b3c27b521d4436f6f673ffd15d ruby-default-gems-3.0.7-165.el9_6.1.noarch.rpm SHA-256: 6d19952906afa04807458bb78809bf988393a4522addd0dd570adb13c2d88c9f ruby-devel-3.0.7-165.el9_6.1.i686.rpm SHA-256: 27948ad8a700bed42604f2759df5973eb1ea18a8a523da7d834e24c18869bd2c ruby-devel-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: c4b16192c8bf4f716f788451e87bd679f7025965553d91d5bf0343683fad5df0 ruby-libs-3.0.7-165.el9_6.1.i686.rpm SHA-256: 1b902aacbc975af3916204898ecf82c5e1b23e76e8f60ce423a0dd027c4c9684 ruby-libs-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 52f9f3063895bb14190ec2cd3de8db68b4c1b51e0d1f5cf20364d44c07b51784 ruby-libs-debuginfo-3.0.7-165.el9_6.1.i686.rpm SHA-256: 0866ab288d3650ff9617ccbc961668f255c80462cf26671470ab10c8a95e84a7 ruby-libs-debuginfo-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 406f7ab0eb15fe700093fd2f206748d410de0a3a31acd47e51758c9a66e4f26c rubygem-bigdecimal-3.0.0-165.el9_6.1.x86_64.rpm SHA-256: fc75becd2aba2639d18b862015eea7e32157de6707b96db634a47c78b5e3a432 rubygem-bigdecimal-debuginfo-3.0.0-165.el9_6.1.i686.rpm SHA-256: 16eb61f6d517937ad71f4b80285fb9a8f3eb3984b0c315156868b7a307de9850 rubygem-bigdecimal-debuginfo-3.0.0-165.el9_6.1.x86_64.rpm SHA-256: 7c0689dd6e708dd22d28651d81e0ea7b59e7ab3d3581e82be4a38c2355e419e2 rubygem-bundler-2.2.33-165.el9_6.1.noarch.rpm SHA-256: 9df3fe202f75e9697417373cf7c5185824d40c3e9edd1287d0a45baa9173c59f rubygem-io-console-0.5.7-165.el9_6.1.x86_64.rpm SHA-256: ac62666348a89a487510d75ede0e8bb49a2a8380fab908f8dd4373969b83a195 rubygem-io-console-debuginfo-0.5.7-165.el9_6.1.i686.rpm SHA-256: 32203f3e33301c70797cbcfce484b4d7d1f15b1ec638b06a2366f24171dd5c0a rubygem-io-console-debuginfo-0.5.7-165.el9_6.1.x86_64.rpm SHA-256: 431edcb86a97925ba2f0fe4fee803e172e7775bdbc4fe43a65088529b3bfdfad rubygem-irb-1.3.5-165.el9_6.1.noarch.rpm SHA-256: 705af7ceb649bd0876519ac44373c972b8b09a562f34d2616f93488fe1ad995b rubygem-json-2.5.1-165.el9_6.1.x86_64.rpm SHA-256: ba1b293ef7a9f08927c128f4e213abc5bebef6b87e3e2a61b41aa7cb0e3a5b34 rubygem-json-debuginfo-2.5.1-165.el9_6.1.i686.rpm SHA-256: 2c1ac84d470734e100ec1e47acd920eb30ae111b867b357d24a0dd0c124a72eb rubygem-json-debuginfo-2.5.1-165.el9_6.1.x86_64.rpm SHA-256: 215a0bca5a5bb3ce7ee09a365d0292952c50c50ad8bb76baf50b2b02a0f40981 rubygem-minitest-5.14.2-165.el9_6.1.noarch.rpm SHA-256: 09cd3899a5c9ddeb54e68bd340a8530267b7d2368bed7e0d30df9ffdec28bb31 rubygem-power_assert-1.2.1-165.el9_6.1.noarch.rpm SHA-256: 6e151b822e2368008bb01c1a281d50b0f6c818abb31f204135fb9fd35e1bc2c0 rubygem-psych-3.3.2-165.el9_6.1.x86_64.rpm SHA-256: 0089963c883188482e91de9bcc61a43a98bef12c665257c2682ee4b27d0a019f rubygem-psych-debuginfo-3.3.2-165.el9_6.1.i686.rpm SHA-256: 19273f1f43c24d2d6b4b264d2513d48e5c834b29e4238f8282030a0a4bb6ecdd rubygem-psych-debuginfo-3.3.2-165.el9_6.1.x86_64.rpm SHA-256: 20aca733debaa00414ed4cb87d35fbdc1fd7be058ee654452dc7a89bdf8342f4 rubygem-rake-13.0.3-165.el9_6.1.noarch.rpm SHA-256: 9aa9162dbeb1ee12b36d97885d08a648c1187c52bc23bdb1dd8efaf7bfec61ee rubygem-rbs-1.4.0-165.el9_6.1.noarch.rpm SHA-256: 366b4f5435237cbaa3a67354dcad838b53abbd7fcdbbe50cdec0888b023d3911 rubygem-rdoc-6.3.4.1-165.el9_6.1.noarch.rpm SHA-256: e41a41d8476e6a2c93fafd9e2df55aac00660add7c77999e9fad7716cfa0d458 rubygem-rexml-3.2.5-165.el9_6.1.noarch.rpm SHA-256: 8582c1e4ebe3396945b89b9446296910ab814afc14ea1a1531f0cf916aeec61e rubygem-rss-0.2.9-165.el9_6.1.noarch.rpm SHA-256: ee087f814334244765012d47afcda79ecde91f360247b264c363ca4079e3b872 rubygem-test-unit-3.3.7-165.el9_6.1.noarch.rpm SHA-256: 07773599d9026b155b82ae3bb1e9200346e1688bc131caaafb791bcb73f5123f rubygem-typeprof-0.15.2-165.el9_6.1.noarch.rpm SHA-256: f8afcea143f1bbce8866338544500f9a824729ae3237764d2f37e637f3ade5c4 rubygems-3.2.33-165.el9_6.1.noarch.rpm SHA-256: 36bda8021d0d7cc7518afc880461d5f3b8c8fd2a884fb1aceaf05ad97edab2c2 rubygems-devel-3.2.33-165.el9_6.1.noarch.rpm SHA-256: fd19da7b29779f810aa61ef384437e19924a9927ebbed91a6f3fd3313258b1e1 Red Hat Enterprise Linux Server - AUS 9.6 SRPM ruby-3.0.7-165.el9_6.1.src.rpm SHA-256: 78f429549e1ffce18520aa24a2a8724b28cb70d62092e4dd375286a485906c4f x86_64 ruby-3.0.7-165.el9_6.1.i686.rpm SHA-256: 0bbd5474bad030017d0ce7debfe01a90b2d2c9b5f3d876642cf2000fae3eb81f ruby-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: d072f7e6ac83e66b3bc5c69f1ab308a8bd345b0ee97d36b5867faf37d81faee4 ruby-debuginfo-3.0.7-165.el9_6.1.i686.rpm SHA-256: cfe339fd89e68418520105425237f85084d918b95521536acea1d373e4a89e69 ruby-debuginfo-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 9aa85829d2e443d0af70cd1276ffa0e357885ccf2d56e816a19b00290e7826f9 ruby-debugsource-3.0.7-165.el9_6.1.i686.rpm SHA-256: 42ab1d36129d25be08e13ea0e6eb03b3bc745aa61ef8c7616a932f2066ebc9bb ruby-debugsource-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 7fbcacd61ceca66f5057326f4f6e464b734b25b3c27b521d4436f6f673ffd15d ruby-default-gems-3.0.7-165.el9_6.1.noarch.rpm SHA-256: 6d19952906afa04807458bb78809bf988393a4522addd0dd570adb13c2d88c9f ruby-devel-3.0.7-165.el9_6.1.i686.rpm SHA-256: 27948ad8a700bed42604f2759df5973eb1ea18a8a523da7d834e24c18869bd2c ruby-devel-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: c4b16192c8bf4f716f788451e87bd679f7025965553d91d5bf0343683fad5df0 ruby-libs-3.0.7-165.el9_6.1.i686.rpm SHA-256: 1b902aacbc975af3916204898ecf82c5e1b23e76e8f60ce423a0dd027c4c9684 ruby-libs-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 52f9f3063895bb14190ec2cd3de8db68b4c1b51e0d1f5cf20364d44c07b51784 ruby-libs-debuginfo-3.0.7-165.el9_6.1.i686.rpm SHA-256: 0866ab288d3650ff9617ccbc961668f255c80462cf26671470ab10c8a95e84a7 ruby-libs-debuginfo-3.0.7-165.el9_6.1.x86_64.rpm SHA-256: 406f7ab0eb15fe700093fd2f206748d410de0a3a31acd47e51758c9a66e4f26c rubygem-bigdecimal-3.0.0-165.el9_6.1.x86_64.rpm SHA-256: fc75becd2aba2639d18b862015eea7e32157de6707b96db634a47c78b5e3a432 rubygem-bigdecimal-debuginfo-3.0.0-165.el9_6.1.i686.rpm SHA-